WordPress Zoner - Real Estate premium theme <= 4.1.1 - Insecure Direct Object References (IDOR) vulnerability

Insecure Direct Object References IDOR vulnerability found by Vlad Vector Ex.Mi in WordPress Zoner - Real Estate premium theme versions = 4.1.1. Solution Update the WordPress Zoner - Real Estate premium theme to the latest available version at least 4.2...

CVE-2016-10997

CVE-2016-10997 affects the Beauty-Premium Theme 1.0.8 for WordPress. Multiple sources (NVD, Red Hat, CVE lists, WPVulnDB) describe a CSRF flaw in includes/sendmail.php that enables arbitrary file upload. Concretely, the vulnerability arises from CSRF allowing an attacker-controlled request to upl...

CarSpot Theme <= 2.1.6 - Authenticated Stored XSS

Bad input field data filtering has been discovered in the 'CarSpot – Automotive Car Dealer Wordpress Classified Theme'. Current version of this Premium Theme is 2.1.5. PoC Authorize on the demo website for tests: https://carspot.scriptsbundle.com/, login is [email protected] and passow...

Javo Spot Premium Theme - Unauthenticated Directory Traversal

Print out any file in the via an unauthenticated AJAX request. PoC /wp-admin/admin-ajax.php? jvfrmspotgetjson=../../wp-config.php=jQuery...

WordPress Javo Spot Premium Theme <= 2.0.0 - Unauthenticated Directory Traversal

WordPress Javo Spot Premium Theme = 2.0.0 - Unauthenticated Directory Traversal / Local File Inclusion vulnerability discovered by Soulseekah Solution Update theme to the latest version at least version 2.0.1...

Javo Spot Premium Theme - Unauthenticated Directory Traversal

Print out any file in the via an unauthenticated AJAX request. /wp-admin/admin-ajax.php? jvfrmspotgetjson&fn=../../wp-config.php&callback=jQuery...

WordPress Beauty & Clean 1.0.8 Theme - Arbitrary File Upload

Exploit for php platform in category web applications Exploit Title: Wordpress Beauty Theme File Upload Vulnerability v1.0.8 Discovery Date: 02.09.2016 Public Disclosure Date:03.09.2016 Vendor Homepage: http://www.yourinspirationweb.com Exploit Author: Colette Chamberland Wordfence Contact:...

LineNity WP Premium Theme Local File Inclusion Vulnerability

LineNity WP premium theme suffers from a local file inclusion vulnerability. Document Title: =============== LineNity WP Premium Theme - File Include Vulnerability Product & Service Introduction: =============================== Linenity wordpress theme is a that features a clean and flexible desi...

LineNity WP Premium Theme Local File Inclusion

Document Title: =============== LineNity WP Premium Theme - File Include Vulnerability References Source: ==================== http://www.vulnerability-lab.com/getcontent.php?id=1645 Release Date: ============= 2015-11-15 Vulnerability Laboratory ID VL-ID: ==================================== 164...

WordPress Freely Premium Theme - Information Disclosure

Because of this vulnerability, the attackers can obtain sensitive information. Solution Update the theme...

WordPress Blessing Premium Responsive Theme - Information Disclosure

Because of this vulnerability, the attackers can obtain sensitive information. Solution Update the theme...

WordPress The7 Premium Theme <= 2.1.0 - Cross Site Scripting

Because of this vulnerability, the attackers can inject arbitrary web script or HTML. Solution Update the theme...

WeeklyNews Premium Theme <= 2.2 - Cross-Site Scripting (XSS)

Vendor confirmed fixed in as 2.2.9 although this issue was not mentioned in the changelog. PoC http://www.example.com/?s=test"...

WeeklyNews Premium Theme <= 2.2 - Cross-Site Scripting (XSS)

Vendor confirmed fixed in as 2.2.9 although this issue was not mentioned in the changelog. http://www.example.com/?s=test"...

WordPress Highlight Premium Theme CSRF / Shell Upload

Title : Wordpress Highlight Premium Themes CSRF File Upload Vulnerability Author : DevilScreaM Date : 11/10/2013 - 10 November 2013 Category : Web Applications Type : PHP Vendor : http://themeforest.net Download : http://themeforest.net/item/highlight-powerful-premium-wordpress-theme/168424 Greet...

WordPress Highlight Premium Theme - CSRF

WordPress Highlight Premium theme is prone to a cross-site request forgery vulnerability. It allows an attacker to gain unauthorized access to the affected application by performing certain actions in the context of an authorized user's session. Solution Upgrade the theme...

ShopperPress v2.7 Wordpress - SQL Injection Vulnerability

Title: ====== ShopperPress v2.7 Wordpress - SQL Injection Vulnerability Date: ===== 2012-08-01 References: =========== http://www.vulnerability-lab.com/getcontent.php?id=669 VL-ID: ===== 669 Common Vulnerability Scoring System: ==================================== 6.1 Introduction: =============...

ShopperPress v2.7 Wordpress - Cross Site Vulnerabilities

Document Title: =============== ShopperPress v2.7 Wordpress - Cross Site Vulnerabilities References Source: ==================== http://www.vulnerability-lab.com/getcontent.php?id=670 Release Date: ============= 2012-08-01 Vulnerability Laboratory ID VL-ID: ==================================== 67...